CWE-187: Partial String Comparison
The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
14 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-41110 — Moby authz zero length regression
- CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2024-39742 — IBM MQ Container authentication bypass
- CVE-2026-34785 — Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-14687 — 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2025-23384 — A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDC
- CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-30874 — OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation
Recently published
- CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-14687 — 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-34785 — Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- CVE-2026-30874 — OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation
- CVE-2025-23384 — A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDC
- CVE-2024-41110 — Moby authz zero length regression
- CVE-2024-39742 — IBM MQ Container authentication bypass